Red Hat OpenShift Container Platform

Disabling etcd encryption

Disable etcd encryption when you no longer need to encrypt sensitive cluster resources at rest.

Prerequisites

Access to the cluster as a user with the cluster-admin role.

Procedure

Modify the APIServer object:
```
$ oc edit apiserver
```
Set the encryption field type to identity:
```
spec:
  encryption:
    type: identity
```
The identity value specifies that no encryption is performed. This is the default value.
Save the file to apply the changes.

The decryption process starts. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster.

Verification

Review the Encrypted status condition for the OpenShift API server to verify that its resources were successfully decrypted:
```
$ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'
```
The output shows DecryptionCompleted upon successful decryption:
```
DecryptionCompleted
Encryption mode set to identity and everything is decrypted
```
If the output shows DecryptionInProgress, decryption is still in progress. Wait a few minutes and try again.
Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully decrypted:
```
$ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'
```
The output shows DecryptionCompleted upon successful decryption:
```
DecryptionCompleted
Encryption mode set to identity and everything is decrypted
```
If the output shows DecryptionInProgress, decryption is still in progress. Wait a few minutes and try again.
Review the Encrypted status condition for the OpenShift OAuth API server to verify that its resources were successfully decrypted:
```
$ oc get authentication.operator.openshift.io -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'
```
The output shows DecryptionCompleted upon successful decryption:
```
DecryptionCompleted
Encryption mode set to identity and everything is decrypted
```
If the output shows DecryptionInProgress, decryption is still in progress. Wait a few minutes and try again.